103 matches found
Code injection
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code...
Cross-Site Scripting (XSS)
katello is vulnerable to cross-site scripting. Multiple XSS in various entities allow an attacker to inject and execute arbitary Javascript in a user's browser...
CVE-2020-11652
A flaw was found in salt. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users. Mitigation Mitigation for this issue is either not available or the currently available options d...
CVE-2020-7609
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...
Type confusion
A type confusion vulnerability in the Autodesk FBX-SDK versions 2019.0 and earlier may lead to arbitary code read/write on the system running it...
CVE-2020-7081
Autodesk FBX-SDK is affected by CVE-2020-7081 (type confusion) in versions prior to 2019.5 according to connected sources. The underlying issue is a type confusion in the FBX-SDK that can lead to arbitrary code read/write on the host system. Real-world exploitation details are not provided in the...
CVE-2020-7636
adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function...
CVE-2020-7623
jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument...
CVE-2020-7605
gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...
CVE-2020-9440
A cross-site scripting XSS vulnerability in the WSC plugin through 5.5.7.5 for CKEditor 4 allows remote attackers to run arbitrary web script inside an IFRAME element by injecting a crafted HTML element into the editor...
CVE-2019-9491
Trend Micro Anti-Threat Toolkit ATTK versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution RCE when executed...
USN-4156-2: SDL vulnerabilities
USN-4156-1 fixed several vulnerabilities in SDL. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM. Original advisory details: It was discovered that SDL incorrectly handled certain images. If a user were tricked into opening a crafted image file, a remote...
USN-4129-2: curl vulnerability
USN-4129-1 fixed a vulnerability in curl. This update provides the corresponding update for Ubuntu 12.04 ESM and 14.04 ESM. Original advisory details: Thomas Vegas discovered that curl incorrectly handled memory during TFTP transfers. A remote attacker could use this issue to crash curl, resultin...
CVE-2016-10836
cPanel before 55.9999.141 allows arbitrary file-read operations during authentication with caldav SEC-108...
Race condition
deepin-clone before 1.1.3 uses a predictable path /tmp/.deepin-clone/mount/ in the Helper::temporaryMountDevice function to temporarily mount a file system as root. An unprivileged user can prepare a symlink at this location to have the file system mounted in an arbitrary location. By winning a...
SUSE SLES11 Security Update : openwsman (SUSE-SU-2019:13981-1)
This update for openwsman fixes the following issues : Security issues fixed : CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure bsc1122623. CVE-2019-3833: Fixed a vulnerability in processconnection which could allow an attacker to trigger an...
WordPress WooCommerce Plugin Cross-site Scripting (CVE-2019-9168)
A cross-site scripting vulnerability exists in WordPress WooCommerce Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...
CVE-2018-17132
admin/goodsupdate.php in PHPMyWind 5.5 allows Admin users to execute arbitrary code via the attrvalue array parameter...
CVE-2018-13594
The mintToken function of a smart contract implementation for CardFactory, an Ethereum token, has an integer overflow that allows the owner of the contract to set the balance of an arbitrary user to any value...